Air-Gapped & Offline Deployment Guide

Step-by-step instructions for exporting release images and deploying self-hosted platform nodes in strictly isolated, air-gapped environments without external internet connectivity.

Offline Deployment Flow

flowchart LR
    A[Connected Machine] -->|1. Download Bundle & Export Images| B[Offline Archive images.tar.gz]
    B -->|2. Secure Transfer USB / SFTP| C[Air-Gapped Server]
    C -->|3. Run ./install-offline.sh| D[Active Local Platform Node]

1. Prepare the Offline Package (Connected Workstation)

1. In your Client Portal, navigate to your deployment and click Download Offline Bundle (ZIP).
2. Unpack the downloaded archive:

   unzip deployment-bundle.zip -d ./offline-package
   cd ./offline-package
   

3. Export all platform Docker images into a single compressed archive using export-images.sh:

   chmod +x export-images.sh
   ./export-images.sh --output=images.tar.gz
   

The script authenticates with the platform container registry, downloads all microservices for your licensed release version, and bundles them into images.tar.gz.

2. Transfer Package to the Air-Gapped Host

Copy the prepared directory to your destination server via your organization's approved secure transfer protocols:

Directory structure on the air-gapped host:

offline-package/
├── docker-compose.yml
├── install-offline.sh
├── export-images.sh
├── .env.template
├── images.tar.gz
└── branding/ (optional)

3. Run the Air-Gapped Installer

On the isolated host, run the offline installer:

cd ./offline-package
chmod +x install-offline.sh
./install-offline.sh --images=images.tar.gz --dir=/opt/dez-platform --yes

Supported Parameters:

• --images= — Path to the Docker images bundle archive (images.tar.gz).
• --dir= — Installation directory on the host (default: /opt/dez-platform).
• --domain= — Internal hostname or LAN IP address (e.g. 192.168.1.100 or platform.internal.local).
• --yes — Non-interactive mode (skips interactive confirmation prompts).

4. Air-Gapped Node Architecture

1. Autonomous Licensing: The installer provisions a 1-year cryptographically signed ECDSA P-256 JWT license token. The node functions completely autonomously without external verification.
2. Local Extensions: Plugins are uploaded and installed locally via the admin dashboard as .tgz packages.
3. Local Reverse Proxy: NGINX / Caddy is automatically configured with internal certificates for LAN/WAN access.